Subject: Re: [Asrg] 7. BCP - Abuse Reporting standard

From: John Levine <[email-masked]>
Date: 8 Jan 2004 02:05:59 -0000

>How do you want to proceed with? Should we get a draft agenda or 
>description for the subgroup, and likely players, and start getting 
>people to join? Or do you want to wait until the AOL meeting?

No reason to wait, let me look at my notes and see who the volunteers
are.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 8 Jan 2004 14:24:08 -0500

This makes no difference toward the adoption of a proposed methodology.  I.e. 
all vendors do not implement every RFC which is recommended for an IP host, 
however this does not affect interoperability.  Likewise, citing or 'adoption' 
of RFC2142 concepts or the RFC itself, in an anti-spam architecture is not 
limiting to the scope or effectiveness of that architecture.  Whether one or 
many methods are supported for determination of abuse reporting, I think, will 
be implementation specific and should be left as such.

Adoption of such a 'standard' into the technical specifications of a working 
solution should appropriately reference such RFCs for the sake of a common 
point of reference.  For example, not everyone uses [email-masked], 
however the idea of an address for reporting this class of 'incident' is a 
widely supported concept though not a requirement.  If an implementation uses 
some specific methodology that method should be described and/or its 
assumptions enumerated, e.g. "this software...uses RFC2142 recommended e-mail 
addresses for determination of inappropriate use reporting."

-e

On Wednesday, January 07, 2004 8:02 PM, Markus Stumpf 
[SMTP:[email-masked]] wrote:
> On Wed, Jan 07, 2004 at 12:02:51PM +0000, Jon Kyme wrote:
> > I think "abuse" is pretty much the de facto standard, supported by rfc2142,
> > adopting anything else would take some justifying.
>
> Yes, but abuse @ whatdomain?
> The most reliable information is the IP address from which the spam
> was injected into my system.
>
> ------------------------------------------------------------------------
> h68-146-73-40.cg.shawcable.net:68.146.73.40 rbl-allowed:
>     <[email-masked]> to <[email-masked]>
> Looking up 68.146.73.40 with whois.arin.net is fine:
>     OrgAbuseEmail:  [email-masked]
> ------------------------------------------------------------------------
>
> Let's try another one:
> ------------------------------------------------------------------------
> customer-hmo-61-203.megared.net.mx:200.77.61.203 rejected:
>     <[email-masked]> to <[email-masked]> badrcptto
>   Comment:  This IP address range is under LACNIC responsibility for further
>   Comment:  allocations to users in LACNIC region.
>   Comment:  Please see http://www.lacnic.net/ for further details, or check
>   the
>   Comment:  WHOIS server located at whois.lacnic.net
>
> At least there is
>   ReferralServer: whois://whois.lacnic.net
>
> $ whois -h whois.lacnic.net 200.77.61.203
>
> and now?
> ------------------------------------------------------------------------
>
> The LACNIC example also holds for e.g. RIPE and leads to things like:
>
> remarks: ---------------------------------------------------------
> remarks: Please send abuse and spam notifications to [email-masked]
> remarks: ---------------------------------------------------------
>
> trouble: SPAM/COMPLAINTS to: [email-masked]
> trouble: SPAM/COMPLAINTS to other addresses will probably be ignored.
>
> remarks: ************************************************************
> remarks: * ABUSE CONTACT: [email-masked] IN CASE OF HACK ATTACKS, *
> remarks: * ILLEGAL ACTIVITY, VIOLATION, SCANS, PROBES, SPAM, ETC.   *
> remarks: ************************************************************
>
> remarks: Please send abuse notification to [email-masked]
>
> (I think you get the idea) while other have no abuse contact at all.
>
> 	\Maex
>
> --
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
> Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
> "The security, stability and reliability of a computer system is reciprocally
>  proportional to the amount of vacuity between the ears of the admin"
>

---

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 8 Jan 2004 13:54:50 -0500

Agreed.  I would contend it is a Well Known Methodology (WKM) and thus should 
be definitively (IMHO) refuted prior to deprecation or replacement by a new 
standard or method.  This is unless the proposed standard can be demonstrably 
proven to represent an enhancement or clarification of an existing BCP or WKM.

just my $.02,

-e

On Wednesday, January 07, 2004 7:03 AM, Jon Kyme [SMTP:[email-masked]] 
wrote:
>
> Art Pollard>
> > standard reporting address should be specified.  Most have settled on
> > [email-masked] but not all and it is only an informal standard at
> > best.
> >
>